You open your online game and find that somebody else has been using your account. Your character has moved, messages have been sent, or settings have changed. That does not necessarily mean the password was mathematically “cracked”. It may have been guessed, reused from another service, entered into a fake website or exposed when a service was compromised.

To understand how passwords get stolen, it helps to ask what a password actually proves. The answer involves two different jobs: identifying which account is being requested and authenticating, or showing that the person signing in is authorised to use it. Later, we will follow what happens when this evidence is copied, tricked out of someone or replaced by newer sign-in methods.